Apache Traffic Control Traffic Ops Email Injection Vulnerability
Priority LOW 25CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
Why it matters now
EPSS 0.02824 86th percentileScored 2026-11-07
Fix Fixed github.com/apache/trafficcontrol (Go): 5.1.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Traffic Control | 4.0.0 and later | — | No fix listed | CNA |
| — | github.com/apache/trafficcontrol (Go) | before 5.1.3 | 5.1.3 | Patch available | GHSA-gw97-f6h8-gm94 |
- Apache Traffic Control VendorApache Affected 4.0.0 and later Fixed in — No fix listed CNA
- github.com/apache/trafficcontrol (Go) Vendor— Affected before 5.1.3 Fixed in 5.1.3 Patch available GHSA-gw97-f6h8-gm94
Remediation
- Fix · GHSA-gw97-f6h8-gm94 github.com/apache/trafficcontrol (Go) Fixed in 5.1.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42009
- 2026-10-03 Alias added: GHSA-gw97-f6h8-gm94
References
Advisory 3
- https://lists.apache.org/thread.html/re384fd0f44c6d230f31376153c6e8b59e4a669f927c1533d06d702af%40%3Cdev.trafficcontrol.apache.org%3E
- [oss-security] 20211012 CVE-2021-42009: Apache Traffic Control Arbitrary Email Content Insertion in /deliveryservices/request
- https://nvd.nist.gov/vuln/detail/CVE-2021-42009
Other 5
- [trafficcontrol-dev] 20211013 Re: CVE-2021-42009: Apache Traffic Control Arbitrary Email Content Insertion in /deliveryservices/request
- [announce] 20211013 Re: CVE-2021-42009: Apache Traffic Control Arbitrary Email Content Insertion in /deliveryservices/request
- https://github.com/apache/trafficcontrol
- https://lists.apache.org/thread.html/r78d471d8a4fd268a4c5ae6c47327c09d9d4b4467c31da2c97422febb@%3Cdev.trafficcontrol.apache.org%3E
- https://lists.apache.org/thread.html/r7dfa9a89b39d06caeeeb7b5cdc41b3493a9b86cc6cfa059d3f349d87@%3Cannounce.apache.org%3E
More Apache Traffic Control vulnerabilities
- TI-2024-30436 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments CVSS 3.1CRITICAL 9.9
- TI-2021-19325 LDAP filter injection vulnerability in Traffic Ops CVSS 3.1CRITICAL 9.8
- TI-2019-09251 Improper authentication in Apache Traffic Control CVSS 3.1CRITICAL 9.8
- TI-2025-38028 Apache Traffic Control: ReDoS issue in Traffic Router configuration CVSS 3.1HIGH 7.5
- TI-2017-05306 Uncontrolled resource consumption in Apache Traffic Control CVSS 3.0HIGH 7.5
- TI-2022-07358 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth CVSS 3.1HIGH 7.5
Sources
- CVE-2021-42009 · CVE Program
- CVE-2021-42009 · NVD
- FIRST EPSS
- GHSA-gw97-f6h8-gm94 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences